Method for constructing malicious file detection model and method for detecting malicious files

Abstract

The invention relates to a method for constructing a malicious file detection model and a method for detecting malicious files. In the method for constructing a malicious file detection model, a static random forest model, a static LightGBM model, a dynamic random forest model, a dynamic important characteristic random forest model and a dynamic LightGBM model which are used for detecting malicious files are established to form a fusion model, and the fusion model is combined with a malheur model to form a malicious file detection model. According to the malicious file detection model, suspicious malicious files can be found in time, and therefore harm caused by the malicious files is avoided. According to the method for detecting malicious files, the malicious file detection model and a third-party tool are adopted for detection, when new malicious files or malicious software is continuously presented, the malicious files or the malicious software can be found in time to be searched and killed, the accuracy is improved, and the method can adapt to an online detection environment.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a detection model for constructing malicious files and a method for detecting malicious files. Background technique [0002] In recent years, the Internet industry has developed vigorously, and the Internet has become the main way for people to obtain information. With the emergence of various new websites, network information has grown exponentially, and the accompanying security problems have become more and more serious. Malware formed by some malicious files is installed on computers through channels such as websites or email links, but without the user's knowledge, the malware will cooperate with other attack methods to steal user information and even company information. [0003] In the prior art, although a large number of detection and killing schemes have been proposed for malicious software, the existing detection and killing schemes are mainly to establish a v...

AI Technical Summary

Problems solved by technology

This method not only does not detect and kill new malware in a timely manner, but also cannot identify and kill known malware in a timely manner with only a slight change of part of the code or a new shell

In addition, although AI-related algorithms have been applied to malicious file detection in recent years, they all have problems such as low accuracy or not suitable for online environments.

Images